CVE-2020-16952: Microsoft SharePoint application package markup validation RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote code execution with a high EPSS score and public exploit references, though not in KEV and requiring package upload.

What it is

SharePoint fails to validate the source markup of an uploaded application package, allowing crafted packages to execute code. Successful exploitation runs arbitrary code as the SharePoint application pool and farm account, so a single upload can compromise the whole farm.

Impact

An attacker gains arbitrary code execution in the context of the SharePoint application pool and server farm account, effectively taking over the SharePoint deployment and its data.

Attack surface

Reached over the network via SharePoint package upload; the CVSS vector shows no privileges or user interaction required, though the description states a user must upload the crafted package.

Exploitation

Not listed in CISA KEV, but EPSS is 0.71 (99th percentile) and public exploit references exist, indicating high likelihood of exploitation.

What to do

• Apply the Microsoft security update that corrects application package markup validation.
• Restrict who can upload or deploy SharePoint application packages and review existing packages.
• Run the SharePoint application pool and farm account with least privilege to limit post-exploitation reach.
• Monitor and alert on unexpected package uploads and subsequent process creation by SharePoint worker processes.

Detection

• Audit SharePoint logs for application package uploads and deployments, especially from non-admin accounts.
• Monitor for suspicious child processes spawned by w3wp.exe or SharePoint timer services.
• Alert on new or modified files in SharePoint solution/package directories.
• Correlate package upload events with outbound network connections from SharePoint servers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.